DCSync directory replication request from non-DC principal (Certighost)

Ankit Mehta@Secvyn

•updated Aug 19, 2026•2•0•9

Detects Active Directory replication events (Event ID 4662) targeting sensitive objects related to replication (e.g., Replication-Get-Changes-All). The rule filters out known Domain Controllers and designated replication service accounts to identify potential DCSync attacks or unauthorized directory replication attempts.